# MCP Tools element

> Field reference for the MCP Tools canvas element: per-tool RBAC policy bindings for MCP surfaces.

The MCP Tools element attaches OPA policy bindings to individual tools exposed on an MCP surface. It is available on MCP surfaces only and can appear once per surface. When any tool entries are configured, the element activates allowlist enforcement automatically: a tools/call request for an unlisted tool is denied without any additional toggle.
Note

The tool entry list acts as an allowlist when non-empty. A tools/call for a tool with no matching entry is denied. No additional toggle is required to activate enforcement.

## Fields

Each row in the tool entry list configures one tool.

| Field | Type | Required | Default | Description |
| Tool name | string | Yes | — | Name of the MCP tool this policy applies to. Must match the tool name exactly as defined in the MCP server or proxy. |
| Policy Definition | string | Yes | — | ID of the OPA policy definition in the policy store. Evaluated at tools/call time with the McpPolicyContext input schema. |
| Description | string | No | — | Human-readable note shown in the dashboard. Has no runtime effect. |

## Related

- [Control MCP tool access with per-tool policies](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/control-mcp-tool-access-with-per-tool-policies.md): step-by-step guide to adding tool policies to a surface.

- [OPA policies reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/opa-policies.md): the McpPolicyContext input schema used when this element evaluates a policy.

- [Managed Agent reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/managed-agent.md): where to add the element on the canvas.